Use the CData ODBC Driver for Splunk in SAS for Real-Time Reporting and Analytics

SAS is a software suite developed for advanced analytics, multivariate analysis, business intelligence, data management, and predictive analytics. When you pair SAS with the CData ODBC Driver for Splunk, you gain database-like access to live Splunk data from SAS, expanding your reporting and analytics capabilities. This article explains how to create a library for Splunk in SAS and create a simple report based on real-time Splunk data.

The CData ODBC Driver offers unmatched performance for interacting with live Splunk data in SAS due to optimized data processing built into the driver. When you issue complex SQL queries from SAS to Splunk, the driver pushes supported SQL operations, like filters and aggregations, directly to Splunk and utilizes the embedded SQL engine to process unsupported operations (often SQL functions and JOIN operations) client-side. With built-in dynamic metadata querying, you can easily visualize and analyze Splunk data in SAS.

Connect to Splunk as an ODBC Data Source

Information for connecting to Splunk follows, along with different instructions for configuring a DSN in Windows and Linux environments (the ODBC Driver for Splunk must be installed on the machine hosting the SAS System).

To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

When you configure the DSN, you may also want to set the Max Rows connection property. This will limit the number of rows returned, which is especially helpful for improving performance when designing reports and visualizations.

Windows

If you have not already, first specify connection properties in an ODBC DSN (data source name). This is the last step of the driver installation. You can use the Microsoft ODBC Data Source Administrator to create and configure ODBC DSNs.

Linux

If you are installing the CData ODBC Driver for Splunk in a Linux environment, the driver installation predefines a system DSN. You can modify the DSN by editing the system data sources file (/etc/odbc.ini) and defining the required connection properties.

/etc/odbc.ini

[CData Splunk Sys]
Driver = CData ODBC Driver for Splunk
Description = My Description
user = MyUserName
password = MyPassword
URL = MyURL
InitiateOAuth = GETANDREFRESH

For specific information on using these configuration files, please refer to the help documentation (installed and found online).

Create a Splunk Library in SAS

Connect to Splunk in SAS by adding a library based on the CData ODBC Driver for Splunk.

1. Open SAS and expand Libraries in the Explorer pane.
2. In the Active Libraries window, right-click and select New.
3. Name your library (odbclib), select ODBC as the Engine, and click to Enable at startup (if you want the library to persist between sessions).
4. Set Data Source to the DSN you previously configured and click OK. 👁 Creating a library for Splunk in SAS.
   

Create a View from a Splunk Query

SAS natively supports querying data either using a low-code, point-and-click Query tool or programmatically with PROC SQL and a custom SQL query. When you create a View in SAS, the defining query is executed each time the view is queried. This means that you always query live Splunk data for reports, charts, and analytics.

Using the Query Tool

1. In SAS, click Tools -> Query
2. Select the table sources and the table(s) you wish to pull data from. Then, click OK. 👁 Selecting table(s) to visualize.
   
3. Select columns and right-click to add filtering, ordering, grouping, etc. 👁 Selecting columns(s) to visualize and configuring the query.
   
4. Create a local view to contain the query results by right-clicking the SQL Query Tool window, selecting Show Query, and clicking Create View. Name the View and click OK. 👁 Create a local view to work with Splunk data.
   

Using PROC SQL

1. In SAS, navigate to the Editor window.
2. Use PROC SQL to query the data and create a local view.
   NOTE: This procedure creates a view in the Work library. You can optionally specify a library in the create view statement.

   proc sql;
    create view datamodels_view as
    select 
    name, 
    owner 
    from 
    odbclib.datamodels 
    where 
    Id = 'SampleDataset';
   quit;
   

3. Click Run -> Submit to execute the query and create a local view.

Report On or Visualize Splunk Data in SAS

With a local view created, you can report, visualize, or otherwise analyze Splunk data using the powerful SAS features. Print a simple report using PROC PRINT and create a basic graph based on the data using PROC GCHART.

Print an HTML Report

1. In SAS, navigate to the Editor window.
2. Use PROC PRINT to print an HTML report for the Splunk DataModels data.

   proc print data=datamodels;
    title "Splunk DataModels Data";
   run;
   

   👁 A simple Splunk data report.
   

Print a Chart

1. In SAS, navigate to the Editor window.
2. Use PROC GCHART to create a chart for the DataModels data.

   proc gchart data=datamodels;
    pie name / sumvar=owner
    value=arrow
    percent=arrow
    noheading
    percent=inside plabel=(height=12pt)
    slice=inside value=none
    name='DataModelsChart';
   run;
   

   👁 A simple Splunk data chart.